Security readout for executives and security teams
Plain-English summary
n8n versions before 2.2.2 can accept forged Stripe webhook events for workflows using the Stripe Trigger node. If an attacker knows the webhook URL, they may cause business automations to run as though Stripe sent a real payment or subscription event.
Executive priority
Prioritize remediation for n8n systems tied to billing, subscriptions, provisioning, account changes, or financial reporting. The issue is not described as broadly exploitable, but forged payment events could create business process errors if downstream automations trust Stripe triggers.
Technical view
The Stripe Trigger node created a Stripe webhook signing secret but did not verify incoming requests against it. A matching event type sent to a known webhook URL could trigger the workflow unauthenticated. Affected versions are n8n 0.150.0 through before 2.2.2. CVSS is 6.5, with high integrity impact and high attack complexity.
Likely exposure
Exposure is limited to n8n deployments running affected versions with active workflows using Stripe Trigger nodes. Risk increases where workflow access is broad, because authenticated n8n users with workflow access can view the webhook ID. The high-entropy webhook URL reduces opportunistic exposure.
Exploitation context
No active exploitation is reported in the provided sources, and the CVE is not listed as KEV. Exploitation requires knowing the webhook URL, then sending a forged Stripe-like event that matches an active trigger’s expected event type.
Researcher notes
Focus triage on Stripe Trigger workflows, webhook exposure paths, and downstream actions caused by trusted payment events. The patch is in n8n 2.2.2, with related GitHub advisory, pull request, and commit available. Do not assume impact for workflows not using Stripe Trigger.
Mitigation direction
- Upgrade n8n to version 2.2.2 or later.
- Deactivate affected Stripe Trigger workflows until upgraded.
- Restrict access to workflows containing Stripe Trigger nodes to trusted users only.
- Review vendor advisory and release notes for any additional operational guidance.
Validation and detection
- Inventory n8n instances and confirm versions are below 2.2.2 or upgraded.
- Identify active workflows using the Stripe Trigger node.
- Review workflow access permissions for users who can view webhook details.
- After upgrading, confirm affected workflows still function with legitimate Stripe events.
- Check workflow execution history for unexpected Stripe-triggered runs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-290: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-21894 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N2.24.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/n8n-io/n8n/security/advisories/GHSA-jf52-3f2h-h9j5CVE reference · x_refsource_CONFIRM
- https://github.com/n8n-io/n8n/pull/22764CVE reference · x_refsource_MISC
- https://github.com/n8n-io/n8n/commit/a61a5991093c41863506888336e808ac1eff8d59CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authentication Bypass by Spoofing
Authentication Bypass by Spoofing represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.